using System;
using System.Collections.Generic;
using System.Threading.Tasks;
using JGSY.CMS.LowCode.Platform.Application.DTOs;
using JGSY.CMS.LowCode.Platform.Domain.Entities;

namespace JGSY.CMS.LowCode.Platform.Application.Interfaces
{
    /// <summary>
    /// 安全日志应用服务接口
    /// 提供安全事件日志的业务逻辑操作
    /// </summary>
    public interface ISecurityLogAppService
    {
        /// <summary>
        /// 记录安全事件日志
        /// </summary>
        /// <param name="eventType">事件类型</param>
        /// <param name="message">日志消息</param>
        /// <param name="threatLevel">威胁级别</param>
        /// <param name="userId">用户ID</param>
        /// <param name="ipAddress">IP地址</param>
        /// <param name="userAgent">用户代理</param>
        /// <param name="tenantId">租户ID</param>
        /// <param name="correlationId">关联ID</param>
        /// <param name="isBlocked">是否被阻止</param>
        /// <param name="additionalData">额外数据</param>
        /// <returns>安全日志ID</returns>
        Task<long> LogSecurityEventAsync(
            string eventType,
            string message,
            string? threatLevel = null,
            string? userId = null,
            string? ipAddress = null,
            string? userAgent = null,
            string? tenantId = null,
            string? correlationId = null,
            bool isBlocked = false,
            Dictionary<string, object>? additionalData = null);

        /// <summary>
        /// 记录登录安全事件
        /// </summary>
        /// <param name="context">登录安全上下文</param>
        /// <returns>安全日志ID</returns>
        Task<long> LogLoginSecurityEventAsync(LoginSecurityContext context);

        /// <summary>
        /// 记录权限违规事件
        /// </summary>
        /// <param name="context">权限违规上下文</param>
        /// <returns>安全日志ID</returns>
        Task<long> LogPermissionViolationAsync(PermissionViolationContext context);

        /// <summary>
        /// 记录攻击检测事件
        /// </summary>
        /// <param name="context">攻击检测上下文</param>
        /// <returns>安全日志ID</returns>
        Task<long> LogAttackDetectionAsync(AttackDetectionContext context);

        /// <summary>
        /// 获取安全日志
        /// </summary>
        /// <param name="id">安全日志ID</param>
        /// <returns>安全日志DTO</returns>
        Task<SecurityLogDto?> GetSecurityLogAsync(long id);

        /// <summary>
        /// 获取安全日志列表
        /// </summary>
        /// <param name="tenantId">租户ID</param>
        /// <param name="eventType">事件类型</param>
        /// <param name="threatLevel">威胁级别</param>
        /// <param name="userId">用户ID</param>
        /// <param name="ipAddress">IP地址</param>
        /// <param name="startTime">开始时间</param>
        /// <param name="endTime">结束时间</param>
        /// <param name="isBlocked">是否被阻止</param>
        /// <param name="pageIndex">页索引</param>
        /// <param name="pageSize">页大小</param>
        /// <returns>安全日志列表</returns>
        Task<(List<SecurityLogDto> Items, int TotalCount)> GetSecurityLogsAsync(
            string? tenantId = null,
            string? eventType = null,
            string? threatLevel = null,
            string? userId = null,
            string? ipAddress = null,
            DateTime? startTime = null,
            DateTime? endTime = null,
            bool? isBlocked = null,
            int pageIndex = 1,
            int pageSize = 20);

        /// <summary>
        /// 获取安全威胁统计
        /// </summary>
        /// <param name="tenantId">租户ID</param>
        /// <param name="startTime">开始时间</param>
        /// <param name="endTime">结束时间</param>
        /// <returns>安全威胁统计信息</returns>
        Task<SecurityThreatStatistics> GetSecurityThreatStatisticsAsync(
            string? tenantId = null,
            DateTime? startTime = null,
            DateTime? endTime = null);

        /// <summary>
        /// 获取IP地址风险评估
        /// </summary>
        /// <param name="ipAddress">IP地址</param>
        /// <param name="tenantId">租户ID</param>
        /// <returns>IP风险评估结果</returns>
        Task<IpRiskAssessment> GetIpRiskAssessmentAsync(string ipAddress, string? tenantId = null);

        /// <summary>
        /// 获取用户安全活动统计
        /// </summary>
        /// <param name="userId">用户ID</param>
        /// <param name="tenantId">租户ID</param>
        /// <param name="startTime">开始时间</param>
        /// <param name="endTime">结束时间</param>
        /// <returns>用户安全活动统计</returns>
        Task<UserSecurityStatistics> GetUserSecurityStatisticsAsync(
            string userId,
            string? tenantId = null,
            DateTime? startTime = null,
            DateTime? endTime = null);

        /// <summary>
        /// 批量记录安全事件
        /// </summary>
        /// <param name="events">安全事件列表</param>
        /// <returns>记录的事件数量</returns>
        Task<int> LogBatchSecurityEventsAsync(IEnumerable<SecurityEventContext> events);
    }

    /// <summary>
    /// 登录安全上下文
    /// </summary>
    public class LoginSecurityContext
    {
        public string? UserId { get; set; }
        public string? UserName { get; set; }
        public string LoginResult { get; set; } = string.Empty; // Success, Failed, Blocked
        public string? FailureReason { get; set; }
        public string? IpAddress { get; set; }
        public string? UserAgent { get; set; }
        public string? TenantId { get; set; }
        public string? CorrelationId { get; set; }
        public string? GeolocationInfo { get; set; }
        public string? DeviceInfo { get; set; }
        public bool IsNewDevice { get; set; } = false;
        public bool IsSuspiciousActivity { get; set; } = false;
        public int AttemptCount { get; set; } = 1;
        public Dictionary<string, object>? AdditionalData { get; set; }
    }

    /// <summary>
    /// 权限违规上下文
    /// </summary>
    public class PermissionViolationContext
    {
        public string? UserId { get; set; }
        public string? UserName { get; set; }
        public string RequiredPermission { get; set; } = string.Empty;
        public string AccessedResource { get; set; } = string.Empty;
        public string? RequestPath { get; set; }
        public string? HttpMethod { get; set; }
        public string? IpAddress { get; set; }
        public string? UserAgent { get; set; }
        public string? TenantId { get; set; }
        public string? CorrelationId { get; set; }
        public string ViolationType { get; set; } = string.Empty; // Unauthorized, Forbidden, Escalation
        public int RiskScore { get; set; } = 0;
        public Dictionary<string, object>? AdditionalData { get; set; }
    }

    /// <summary>
    /// 攻击检测上下文
    /// </summary>
    public class AttackDetectionContext
    {
        public string AttackType { get; set; } = string.Empty; // SQL Injection, XSS, CSRF, etc.
        public string ThreatLevel { get; set; } = string.Empty; // Low, Medium, High, Critical
        public string? IpAddress { get; set; }
        public string? UserAgent { get; set; }
        public string? RequestPath { get; set; }
        public string? HttpMethod { get; set; }
        public string? UserId { get; set; }
        public string? TenantId { get; set; }
        public string? CorrelationId { get; set; }
        public bool IsBlocked { get; set; } = false;
        public string? BlockReason { get; set; }
        public string? AttackSignature { get; set; }
        public string? GeolocationInfo { get; set; }
        public int RiskScore { get; set; } = 0;
        public Dictionary<string, object>? AttackData { get; set; }
    }

    /// <summary>
    /// 通用安全事件上下文
    /// </summary>
    public class SecurityEventContext
    {
        public string EventType { get; set; } = string.Empty;
        public string Message { get; set; } = string.Empty;
        public string? ThreatLevel { get; set; }
        public string? UserId { get; set; }
        public string? IpAddress { get; set; }
        public string? UserAgent { get; set; }
        public string? TenantId { get; set; }
        public string? CorrelationId { get; set; }
        public string? RequestPath { get; set; }
        public string? HttpMethod { get; set; }
        public bool IsBlocked { get; set; } = false;
        public string? BlockReason { get; set; }
        public int? RiskScore { get; set; }
        public Dictionary<string, object>? AdditionalData { get; set; }
        public DateTime Timestamp { get; set; } = DateTime.UtcNow;
    }

    /// <summary>
    /// 安全威胁统计信息
    /// </summary>
    public class SecurityThreatStatistics
    {
        public int TotalSecurityEvents { get; set; }
        public int CriticalThreats { get; set; }
        public int HighThreats { get; set; }
        public int MediumThreats { get; set; }
        public int LowThreats { get; set; }
        public int BlockedEvents { get; set; }
        public Dictionary<string, int> ThreatTypeCount { get; set; } = new();
        public Dictionary<string, int> AttackTypeCount { get; set; } = new();
        public Dictionary<string, int> ThreatsByHour { get; set; } = new();
        public List<string> TopThreatIps { get; set; } = new();
        public List<string> TopTargetPaths { get; set; } = new();
    }

    /// <summary>
    /// IP风险评估结果
    /// </summary>
    public class IpRiskAssessment
    {
        public string IpAddress { get; set; } = string.Empty;
        public int RiskScore { get; set; } = 0;
        public string RiskLevel { get; set; } = string.Empty; // Low, Medium, High, Critical
        public int TotalEvents { get; set; }
        public int BlockedEvents { get; set; }
        public int LoginFailures { get; set; }
        public int PermissionViolations { get; set; }
        public int AttackAttempts { get; set; }
        public string? GeolocationInfo { get; set; }
        public bool IsWhitelisted { get; set; } = false;
        public bool IsBlacklisted { get; set; } = false;
        public DateTime LastActivity { get; set; }
        public List<string> RecentAttackTypes { get; set; } = new();
    }

    /// <summary>
    /// 用户安全活动统计
    /// </summary>
    public class UserSecurityStatistics
    {
        public string UserId { get; set; } = string.Empty;
        public int TotalSecurityEvents { get; set; }
        public int LoginEvents { get; set; }
        public int PermissionViolations { get; set; }
        public int FailedLogins { get; set; }
        public int SuspiciousActivities { get; set; }
        public Dictionary<string, int> EventTypeCount { get; set; } = new();
        public Dictionary<string, int> IpAddressCount { get; set; } = new();
        public DateTime LastLoginTime { get; set; }
        public string? LastLoginIp { get; set; }
        public int RiskScore { get; set; } = 0;
        public bool HasSuspiciousPatterns { get; set; } = false;
    }
}
